Drupal is all over government sites. So is Wordpress. Do you expect them to be using closed source CMSs or something? (I get that Drupal is insecure, but no, it's not "illegal" to use Drupal...)
The US Federal Government is essentially the arbiter of all regulations and minimum standards within the United States. It's just surprising to see an opensource framework running on Apache/Coyote expected to run over HTTP.
